UpHeron
All posts

Critical vulnerabilities

12 critical vulnerabilities in 6 servers and applications

12 vulnerabilities rated critical (CVSS 9.0 or higher) found on 3 November 2026: Authentication bypass in servers and applications, WatchGuard Fireware OS (7), Remote code execution in servers and applications and more.

  • 12 critical

Authentication bypass in servers and applications

3 vulnerabilities

  1. 9.6Fortinet FortiSandboxAn authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9,…Up to 5.0.6CVE-2026-107656
  2. 9.3REDAXOREDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History PluginFixed in 5.21.4CVE-2026-117532
  3. 9.1Parse ServerParse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter SubclassesFixed in 8.6.102, 9.10.5-alpha.2CVE-2026-116163

WatchGuard Fireware OS

7 vulnerabilities · Servers and applications · most fixed in 12.5.22, 12.12.4, 2026.4

  1. 9.5Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code ExecutionFixed in 12.12.4, 2026.4CVE-2026-103594
  2. 9.2Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code ExecutionFixed in 12.12.4, 2026.4CVE-2026-112709
  3. 9.2Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code ExecutionFixed in 12.12.4, 2026.4CVE-2026-112710
  4. 9.2Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code ExecutionFixed in 12.12.4, 2026.4CVE-2026-93857
  5. 9.2Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action InjectionFixed in 12.12.4, 2026.4CVE-2026-93865
Show 2 more
  1. 9.2Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds WriteFixed in 12.12.4, 2026.4CVE-2026-93866
  2. 9.1Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code ExecutionFixed in 12.12.4, 2026.4CVE-2026-103593

Remote code execution in servers and applications

1 vulnerability

  1. 9.2vLLMvLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revisionFixed in 0.31.0CVE-2026-114053

Broken access control in servers and applications

1 vulnerability

  1. 9.1Veeam Backup & ReplicationA vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.Fixed in 13.0.3, 13.1.2CVE-2026-108142

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.